REMARKS 

Claims 1 , 24 and 47 have been amended. New claim 48 has been added. Support for 
the claim amendments and new claim 48 can be found at pages 9 and 20 of the specification, 
for example. 

In addition, minor amendments have been made to dependent claims 24, 33-39, 44 and 

45. 

Claims 1, 4-6, 8-24, 27-29 and 31-48 are currently pending and under consideration. 
Reconsideration is respectfully requested. 

I. REJECTION OF CLAIMS 1, 4-6, 8-24, 27-29 AND 31-47 UNDER 35 U.S.C. 102(b) AS 
BEING ANTICIPATED BY HUFF (WO/99/57624): 

Claim 1 has been amended to recite an information collection unit which collects 
information related to a kind, a content, an order, and a time interval of two or more 
communications in a progress process of an attack event or a leakage event, such that the 
information is collected through an attack caused by induction, so that the collected 
information is analyzed to be recognized as an attack pattern to be used to predict a 
future attack which may occur; and a reflection unit which reflects the information collected 
and regulated by the information collection unit upon the database, to thereby predict a possible 
attack event or a leakage event in advance, and to avoid the predicted attack event or leakage 
event before execution of the predicted attack event or leakage event". Claims 24 and 47 have 
been amended to recite features somewhat similar to those recited in amended claim 1 . 

At page 3 of the Office Action, the Examiner asserts that Huff discloses "offensive 
countermeasures" which are taken against intended intrusions and does not only react after an 
attack is successful. 

The Applicants respectfully submit that Huff fails to disclose "information is collected 
through an attack caused by induction, so that the collected information is analyzed to be 
recognized as an attack pattern to be used to predict a future attack which may occur... reflects 
the information ...upon the database," as recited in amended claim 1, for example. That is, in 
various embodiments of the present invention, an attack pattern of an attack caused by 
induction is stored in the database, in order to predict a future attack. 
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In contrast, Huff merely discloses a method for receiving information that an intrusion or 
misuse has occurred and taking countermeasures on a computer network (see page 4, lines 17- 
20). The security computer system can automatically take countermeasures against the 
suspected or actual intrusion or misuse. Automatic countermeasures include using a defensive 
countermeasure to increase an auditing level conducted by an intrusion detection mission. An 
offensive countermeasure is also used to send a chase mission to the suspected or actual 
intruder. The offensive chase mission can be automatically dispatched with human intervention. 

As pointed out by the Examiner at page 3 of the Office Action, in Huff , an offensive agent 
is deployed to instruct a service request processor to dispatch a chase mission to a node from 
which the suspected intrusion is taking place . The chase mission then sends information to 
a service manager regarding the suspected intruder including an address and other information 
contained on the suspected intruder's computer (see column 21 , lines 6-13). Further, at page 
20 lines 19-26, Huff defines misuse to include a computer accessing a database which it does 
not normally access. For example, an attempted intrusion includes a login by a computer which 
does not have access to the system, or an attempted logon which tried to login three times but 
fails, excess system calls, too many root logins and system memory changes, for example. The 
Applicants respectfully submit that in Huff , a countermeasure is only carried out after the 
detection of an actual intrusion or suspected misuse. That is, an attempted logon is still 
considered to be "a suspected misuse". This is not comparable to "information... collected 
through an attack caused by induction, so that the collected information is analyzed to be 
recognized as an attack pattern to be used to predict a future attack which may occur," as 
recited in amended claim 1, for example. Thus, again, in Huff , defensive steps are merely taken 
to halt further intrusion or misuse (see page 4, lines 15-16). 

The present invention, as recited in amended claim 1 , for example, patentably 
distinguishes over Huff . 

Although the above comments are specifically directed to claim 1 , it is respectfully 
submitted that the comments would be helpful in understanding differences of various other 
rejected claims over the cited reference. Therefore, it is respectfully submitted that the rejection 
is overcome. 
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II. CONCLUSION: 

In view of the foregoing amendments and remarks, it is respectfully submitted that each 
of the claims patentably distinguishes over the prior art, and therefore, defines allowable subject 
matter. A prompt and favorable reconsideration of the rejection along with an indication of 
allowability of all pending claims are therefore respectfully requested. 

If there are any additional fees associated with filing of this Amendment, please charge 
the same to our Deposit Account No. 19-3935. 



Respectfully submitted, 



Date: 




Registration No. 52,797 



1201 New York Avenue, NW, 7th Floor 
Washington, D.C. 20005 
Telephone: (202)434-1500 
Facsimile: (202)434-1501 
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